agent-framework-lib 0.8.7.post5__tar.gz → 0.8.7.post7__tar.gz

{agent_framework_lib-0.8.7.post5/agent_framework_lib.egg-info → agent_framework_lib-0.8.7.post7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agent-framework-lib
-Version: 0.8.7.post5
+Version: 0.8.7.post7
 Summary: A comprehensive Python framework for building and serving conversational AI agents with FastAPI
 Author-email: Sebastian Pavel <sebastian@cinco.ai>, Elliott Girard <elliott.girard@icloud.com>
 Maintainer-email: Sebastian Pavel <sebastian@cinco.ai>
@@ -54,6 +54,7 @@ Requires-Dist: playwright>=1.56.0
 Requires-Dist: elasticsearch<9.0.0,>=8.11.0
 Requires-Dist: ddgs>=9.9.3
 Requires-Dist: httpx>=0.28.1
+Requires-Dist: cryptography>=42.0.0
 Requires-Dist: beautifulsoup4>=4.12.0
 Requires-Dist: llama-index>=0.14.16
 Requires-Dist: llama-index-core>=0.14.16

{agent_framework_lib-0.8.7.post5 → agent_framework_lib-0.8.7.post7}/agent_framework/code_delivery/__init__.py

@@ -16,7 +16,12 @@ from agent_framework.code_delivery.git_provider import (
     GitHubCLIProvider,
     GitProvider,
 )
-from agent_framework.code_delivery.herdr_client import HerdrClient
+from agent_framework.code_delivery.herdr_client import (
+    HerdrClient,
+    HerdrLocalClient,
+    HerdrRemoteClient,
+    create_herdr_client,
+)
 from agent_framework.code_delivery.models import (
     VALID_TRANSITIONS,
     CodingRun,
@@ -37,6 +42,9 @@ __all__ = [
     "GitHubCLIProvider",
     "GitProvider",
     "HerdrClient",
+    "HerdrLocalClient",
+    "HerdrRemoteClient",
+    "create_herdr_client",
     "RunState",
     "StateTransition",
     "VALID_TRANSITIONS",

{agent_framework_lib-0.8.7.post5 → agent_framework_lib-0.8.7.post7}/agent_framework/code_delivery/audit.py

@@ -105,6 +105,24 @@ class CodeDeliveryAuditLogger:
         self._index_prefix = index_prefix
         self._es_client: Any | None = None
         self._available = False
+        self._redactor: Any | None = None
+
+    def set_secret_values(self, values: list[str]) -> None:
+        """Install a redactor so secret values (e.g. the GitHub token) are masked
+        in every indexed document — git stdout, herdr payloads, errors, etc.
+
+        Called by the orchestrator whenever the per-session credential changes.
+        """
+        cleaned = [v for v in values if v]
+        if not cleaned:
+            self._redactor = None
+            return
+        try:
+            from agent_framework.security.secret_redactor import SecretRedactor
+
+            self._redactor = SecretRedactor(cleaned)
+        except Exception:  # noqa: BLE001 — never break audit on redactor setup
+            self._redactor = None
 
     # ------------------------------------------------------------------
     # Lifecycle
@@ -310,6 +328,10 @@ class CodeDeliveryAuditLogger:
 
     async def _index(self, doc: dict[str, Any], event_type: str) -> None:
         """Index a document.  Falls back to Python logging on failure."""
+        # Mask any secret values (GitHub token) before the doc leaves the process.
+        if self._redactor is not None and getattr(self._redactor, "active", False):
+            doc = self._redactor.redact_obj(doc)
+
         if self._available and self._es_client:
             try:
                 await self._es_client.index(

{agent_framework_lib-0.8.7.post5 → agent_framework_lib-0.8.7.post7}/agent_framework/code_delivery/config.py

@@ -19,10 +19,21 @@ logger = logging.getLogger(__name__)
 
 
 class HerdrConfig(BaseModel):
-    """Connection settings for the Herdr substrate."""
+    """Connection settings for the Herdr substrate.
 
-    base_url: str = Field("http://127.0.0.1:9876", description="Herdr API base URL")
-    timeout: float = Field(120.0, description="Default request timeout in seconds")
+    Two modes:
+    - ``local`` (default): Uses the ``herdr`` CLI on PATH.  Zero config.
+    - ``remote``: Uses HTTP when ``base_url`` is explicitly provided.
+    """
+
+    mode: Literal["local", "remote"] = Field(
+        "local", description="'local' uses herdr CLI, 'remote' uses HTTP API"
+    )
+    base_url: str = Field(
+        "http://127.0.0.1:9876",
+        description="Herdr HTTP API URL (only used in remote mode)",
+    )
+    timeout: float = Field(120.0, description="Timeout in seconds (CLI or HTTP)")
 
 
 class GitHubConfig(BaseModel):
@@ -56,6 +67,85 @@ class CodeDeliveryConfig(BaseModel):
     retry_on_verify_fail: int = Field(0, description="Retries on verify failure")
 
 
+class RepoEntry(BaseModel):
+    """A single repository the agent is allowed (or not) to deliver to.
+
+    ``repo`` is the canonical ``owner/name`` slug.  ``enabled`` is the per-repo
+    on/off toggle enforced by the orchestrator before any push/PR.
+    """
+
+    repo: str = Field(..., description="Repository slug, e.g. 'octocat/hello-world'")
+    enabled: bool = Field(True, description="Whether code delivery to this repo is allowed")
+    default_base_branch: str = Field(
+        "", description="Base branch override for this repo (empty = use github default)"
+    )
+
+
+class GitHubAuthMeta(BaseModel):
+    """Non-secret metadata about a stored GitHub credential.
+
+    The token itself is never carried here — only what is safe to display.
+    """
+
+    login: str = Field("", description="Authenticated GitHub login")
+    scopes: list[str] = Field(default_factory=list, description="Token scopes")
+    token_suffix: str = Field("", description="Last 4 chars of the token, for recognition")
+    validated_at: str = Field("", description="ISO timestamp of last successful validation")
+
+
+class ResolvedCodeDeliveryConfig(BaseModel):
+    """Per-session, fully-resolved code-delivery configuration.
+
+    Produced by ``CodeDeliveryStore.resolve(user_id, session_id)`` after merging
+    env defaults < user config < session override.  Unlike ``CodeDeliveryConfig``
+    this carries the *decrypted* GitHub token and the repo allowlist, so it is a
+    short-lived in-memory object that must never be logged or persisted as-is.
+    """
+
+    # Identity
+    user_id: str | None = None
+    session_id: str | None = None
+
+    # Master feature toggle (default-deny friendly: feature can be turned off)
+    enabled: bool = Field(True, description="Master on/off for code delivery")
+
+    # Resolved sub-configs (reuse existing models)
+    herdr: HerdrConfig = Field(default_factory=HerdrConfig)
+    github: GitHubConfig = Field(default_factory=GitHubConfig)
+    backend: BackendConfig = Field(default_factory=BackendConfig)
+    max_concurrent_runs: int = 2
+    verify_command: str = ""
+    retry_on_verify_fail: int = 0
+
+    # Credentials + allowlist (sensitive)
+    github_token: str | None = Field(
+        None, description="Decrypted GitHub token (transient — never persist/log)"
+    )
+    github_auth: GitHubAuthMeta | None = Field(
+        None, description="Non-secret metadata about the stored credential"
+    )
+    repos: list[RepoEntry] = Field(default_factory=list, description="Repo allowlist")
+
+    def base_config(self) -> CodeDeliveryConfig:
+        """Return the non-secret ``CodeDeliveryConfig`` slice for orchestrator infra."""
+        return CodeDeliveryConfig(
+            herdr=self.herdr,
+            github=self.github,
+            backend=self.backend,
+            max_concurrent_runs=self.max_concurrent_runs,
+            verify_command=self.verify_command,
+            retry_on_verify_fail=self.retry_on_verify_fail,
+        )
+
+    def find_repo(self, repo_slug: str) -> RepoEntry | None:
+        """Look up an allowlist entry by slug (case-insensitive)."""
+        target = repo_slug.lower()
+        for entry in self.repos:
+            if entry.repo.lower() == target:
+                return entry
+        return None
+
+
 def _config_from_env() -> dict[str, Any]:
     """Build a config dict from environment variables."""
     cfg: dict[str, Any] = {}
@@ -64,6 +154,9 @@ def _config_from_env() -> dict[str, Any]:
     herdr: dict[str, Any] = {}
     if v := os.environ.get("HERDR_BASE_URL"):
         herdr["base_url"] = v
+        herdr["mode"] = "remote"  # explicit URL → remote mode
+    if v := os.environ.get("HERDR_MODE"):
+        herdr["mode"] = v  # explicit override
     if v := os.environ.get("HERDR_TIMEOUT"):
         herdr["timeout"] = float(v)
     if herdr:
@@ -138,7 +231,10 @@ def load_config(path: Path | None = None) -> CodeDeliveryConfig:
 __all__ = [
     "BackendConfig",
     "CodeDeliveryConfig",
+    "GitHubAuthMeta",
     "GitHubConfig",
     "HerdrConfig",
+    "RepoEntry",
+    "ResolvedCodeDeliveryConfig",
     "load_config",
 ]

agent_framework_lib-0.8.7.post7/agent_framework/code_delivery/crypto.py

@@ -0,0 +1,149 @@
+"""Token-at-rest encryption for code-delivery credentials.
+
+GitHub tokens (PAT / fine-grained) are stored encrypted in the per-user/session
+config store.  Encryption is symmetric (Fernet, AES-128-CBC + HMAC) with a key
+read from ``CODE_DELIVERY_SECRET_KEY``.
+
+Security posture — **fail closed**:
+- Storing a token without a valid key raises ``TokenCryptoError`` so a plaintext
+  secret is never persisted.
+- Reading a value that is not a valid ciphertext (e.g. legacy plaintext) raises
+  ``TokenCryptoError`` rather than returning the unverified bytes.
+
+The key is a url-safe base64 32-byte Fernet key.  Generate one with::
+
+    python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
+"""
+
+from __future__ import annotations
+
+import logging
+import os
+
+logger = logging.getLogger(__name__)
+
+_ENV_KEY = "CODE_DELIVERY_SECRET_KEY"
+
+#: Prefix marking a value as code-delivery Fernet ciphertext.  Lets us detect
+#: (and refuse) accidental plaintext without attempting a decrypt.
+_CIPHER_PREFIX = "cdf1:"
+
+
+class TokenCryptoError(Exception):
+    """Raised when encryption/decryption cannot be performed safely."""
+
+
+def _load_key() -> bytes | None:
+    """Return the raw Fernet key from the environment, or None if unset."""
+    raw = os.environ.get(_ENV_KEY, "").strip()
+    if not raw:
+        return None
+    return raw.encode("utf-8")
+
+
+def encryption_available() -> bool:
+    """True if a usable encryption key is configured.
+
+    Endpoints can surface this so operators know the feature is disabled when
+    no key is set, instead of failing only at write time.
+    """
+    key = _load_key()
+    if not key:
+        return False
+    try:
+        from cryptography.fernet import Fernet
+
+        Fernet(key)  # validates key shape
+        return True
+    except Exception as exc:  # noqa: BLE001 — invalid key == unavailable
+        logger.warning("%s is set but invalid: %s", _ENV_KEY, exc)
+        return False
+
+
+def encrypt_token(plaintext: str) -> str:
+    """Encrypt a token for storage.
+
+    Args:
+        plaintext: The raw GitHub token.
+
+    Returns:
+        A prefixed, url-safe ciphertext string safe to persist.
+
+    Raises:
+        TokenCryptoError: If no valid key is configured (fail closed) or the
+            input is empty.
+    """
+    if not plaintext:
+        raise TokenCryptoError("Refusing to encrypt an empty token")
+
+    key = _load_key()
+    if not key:
+        raise TokenCryptoError(
+            f"{_ENV_KEY} is not set — cannot store GitHub credentials encrypted. "
+            "Generate a key with `python -c \"from cryptography.fernet import Fernet; "
+            'print(Fernet.generate_key().decode())"` and set it in the environment.'
+        )
+    try:
+        from cryptography.fernet import Fernet
+
+        token = Fernet(key).encrypt(plaintext.encode("utf-8")).decode("utf-8")
+    except TokenCryptoError:
+        raise
+    except Exception as exc:  # noqa: BLE001
+        raise TokenCryptoError(f"Encryption failed: {exc}") from exc
+    return f"{_CIPHER_PREFIX}{token}"
+
+
+def decrypt_token(ciphertext: str) -> str:
+    """Decrypt a stored token.
+
+    Args:
+        ciphertext: A value produced by :func:`encrypt_token`.
+
+    Returns:
+        The original plaintext token.
+
+    Raises:
+        TokenCryptoError: If no key is configured, the value is not recognised
+            ciphertext (e.g. legacy plaintext), or decryption/verification fails.
+    """
+    if not ciphertext:
+        raise TokenCryptoError("Refusing to decrypt an empty value")
+    if not ciphertext.startswith(_CIPHER_PREFIX):
+        raise TokenCryptoError(
+            "Stored value is not code-delivery ciphertext — refusing to use it "
+            "(plaintext or foreign format). Re-save the credential."
+        )
+
+    key = _load_key()
+    if not key:
+        raise TokenCryptoError(f"{_ENV_KEY} is not set — cannot decrypt credentials")
+
+    payload = ciphertext[len(_CIPHER_PREFIX) :]
+    try:
+        from cryptography.fernet import Fernet, InvalidToken
+
+        try:
+            return Fernet(key).decrypt(payload.encode("utf-8")).decode("utf-8")
+        except InvalidToken as exc:
+            raise TokenCryptoError(
+                "Decryption failed — key mismatch or corrupted ciphertext"
+            ) from exc
+    except TokenCryptoError:
+        raise
+    except Exception as exc:  # noqa: BLE001
+        raise TokenCryptoError(f"Decryption failed: {exc}") from exc
+
+
+def is_ciphertext(value: str | None) -> bool:
+    """True if *value* looks like code-delivery ciphertext."""
+    return bool(value) and value.startswith(_CIPHER_PREFIX)
+
+
+__all__ = [
+    "TokenCryptoError",
+    "decrypt_token",
+    "encrypt_token",
+    "encryption_available",
+    "is_ciphertext",
+]

{agent_framework_lib-0.8.7.post5 → agent_framework_lib-0.8.7.post7}/agent_framework/code_delivery/git_provider.py

@@ -10,6 +10,8 @@ import asyncio
 import fnmatch
 import json
 import logging
+import os
+import re
 import shutil
 from abc import ABC, abstractmethod
 from typing import Any
@@ -21,6 +23,27 @@ logger = logging.getLogger(__name__)
 
 _DEFAULT_TIMEOUT = 30  # seconds per subprocess call
 
+# owner/repo extraction from common remote URL shapes:
+#   git@github.com:owner/repo.git
+#   https://github.com/owner/repo.git
+#   ssh://git@github.com/owner/repo
+_REMOTE_SLUG_RE = re.compile(
+    r"[:/](?P<owner>[^/:]+)/(?P<repo>[^/]+?)(?:\.git)?/?$"
+)
+
+
+def parse_repo_slug(remote_url: str) -> str | None:
+    """Extract the canonical ``owner/repo`` slug from a git remote URL.
+
+    Returns ``None`` if the URL cannot be parsed.
+    """
+    if not remote_url:
+        return None
+    match = _REMOTE_SLUG_RE.search(remote_url.strip())
+    if not match:
+        return None
+    return f"{match.group('owner')}/{match.group('repo')}"
+
 
 class GitProviderError(Exception):
     """Raised when a git/provider operation fails."""
@@ -76,10 +99,21 @@ class GitProvider(ABC):
 class GitHubCLIProvider(GitProvider):
     """GitHub provider using the ``gh`` and ``git`` CLIs."""
 
-    def __init__(self, config: GitHubConfig) -> None:
+    def __init__(
+        self, config: GitHubConfig, extra_env: dict[str, str] | None = None
+    ) -> None:
         self._config = config
+        self._extra_env: dict[str, str] = dict(extra_env or {})
         self._ensure_binaries()
 
+    def set_extra_env(self, extra_env: dict[str, str] | None) -> None:
+        """Set env vars (e.g. ``GH_TOKEN``) injected into every git/gh subprocess.
+
+        Called per session by the orchestrator so each user's GitHub credential
+        scopes only their own runs.
+        """
+        self._extra_env = dict(extra_env or {})
+
     # ------------------------------------------------------------------
     # Public API
     # ------------------------------------------------------------------
@@ -207,12 +241,20 @@ class GitHubCLIProvider(GitProvider):
         cmd_str = " ".join(cmd)
         logger.debug("Running: %s (cwd=%s)", cmd_str, cwd)
 
+        # Inject the per-session credential env (GH_TOKEN/GITHUB_TOKEN) and
+        # disable interactive prompts so a missing/bad token fails fast.
+        env = {**os.environ}
+        if self._extra_env:
+            env.update(self._extra_env)
+        env.setdefault("GIT_TERMINAL_PROMPT", "0")
+
         try:
             proc = await asyncio.create_subprocess_exec(
                 *cmd,
                 cwd=cwd,
                 stdout=asyncio.subprocess.PIPE,
                 stderr=asyncio.subprocess.PIPE,
+                env=env,
             )
             stdout_bytes, stderr_bytes = await asyncio.wait_for(proc.communicate(), timeout=timeout)
         except asyncio.TimeoutError:
@@ -258,4 +300,5 @@ __all__ = [
     "GitHubCLIProvider",
     "GitProvider",
     "GitProviderError",
+    "parse_repo_slug",
 ]